- dovecot - dovecot.org

Found 4 bugs in latest SquirrelMail related to IMAP and SMTP STARTTLS, Dovecot capabilities
by Tobias 03 Apr '16

03 Apr '16

This is a cross-post from the squirrelmail-devel list. It may be of interest if you want to run SquirrelMail and connect to Dovecot (and Postfix, possibly other servers) on a remote host using STARTTLS. BR Tobias -------- Forwarded Message -------- Subject: [SM-DEVEL] 4 bugs, IMAP and SMTP STARTTLS, Dovecot capabilities Date: Sun, 3 Apr 2016 04:27:56 +0200 From: Tobias <lists.zxinn(a)otaking.se> Reply-To: Squirrelmail Developers Mailing List <squirrelmail-devel(a)lists.sourceforge.net> To: squirrelmail-devel(a)lists.sourceforge.net Hello! I've looked for and have not seen any similar issues reported related to STARTTLS. Sourceforge wouldn't let me create an account or else I could have submitted bug reports directly. I'm using SquirrelMail 1.4.23 installed from latest FreeBSD Ports, together with PHP 5.6. I'm attempting to connect using STARTTLS to Dovecot 2.2.22 and Postfix 3.1.0. I've verified the code is not fixed for any of these four issues in the latest 1.5.2 SVN. Issue 2 is not as much of a problem in 1.5.2 as it is in 1.4.23 when using 'login' authentication. I connect to the IMAP and SMTP servers using their IP, but need to override the 'peer_name' to validate the certificate properly. New in PHP 5.6 is also that verify_peer defaults to TRUE, which means I need to either be able to set the peer_name, or disable verify_peer. I've found three issues in functions/imap_general.php, related to STARTTLS and Dovecot IMAP server, as well as one STARTTLS issue in class/deliver/Deliver_SMTP.class.php, class class Deliver_SMTP, function initStream. Issue 1: Stream options ($imap_stream_options) are not used with STARTTLS ($use_imap_tls = 2) in function sqimap_create_stream. The stream options are only used for $use_imap_tls = 1. How to fix: Add something like this: // set context options to allow for SSL option overrides @stream_context_set_option($imap_stream,$stream_options); Before trying to initiate the TLS session here: functions/imap_general.php :: function sqimap_create_stream 826: // start crypto on connection. suppress function errors. 827: if (@stream_socket_enable_crypto($imap_stream,true,STREAM_CRYPTO_METHOD_TLS_CLIENT)) { Issue 2: IMAP capabilities are only read once in function sqimap_create_stream (and subsequently used in sqimap_login to determine certain login options), however the capability list for Dovecot is not the same before and after STARTTLS. From Dovecot, before STARTTLS (telnet <local-ip> 143): * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS LOGINDISABLED] Dovecot ready. From Dovecot, after successful STARTTLS (openssl s_client -starttls imap -connect <local-ip>:143): <SSL session info> --- . OK Pre-login capabilities listed, post-login capabilities have more. a capability * CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN a OK Pre-login capabilities listed, post-login capabilities have more. How to fix: Issue "capability" command after successful STARTTLS to re-read the capabilities. Either as part of function sqimap_create_stream, or after call to sqimap_create_stream and before login options are checked in function sqimap_login. SquirrelMail 1.4.23 uses the return value with capabilities from function sqimap_create_stream to determine if 'login' is a viable option. Dovecot reports LOGINDISABLED prior to STARTTLS. (1.5.2 does not have this check for 'login'.) Issue 3: Multi-line response from the server to the AUTHENTICATE PLAIN (and likely cram/digest md5, possibly even login) are not accepted. The IMAP protocol allows the server to prefix responses which are incomplete with "*", and Dovecot uses this to report capabilities after successful login, but this is not handled by SquirrelMail's sqimap_login function. SquirrelMail reports: Unknown error: IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SEARCH=FUZZY SPECIAL-USE QUOTA The full output from Dovecot is: * CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SEARCH=FUZZY SPECIAL-USE QUOTA A003 OK Logged in How to fix: Check if '*' is the first token in a response, and read another line from the stream. Possibly something similar to this: while (substr($read,0,1) == '*') { // OK so far.. $read = sqimap_fgets($imap_stream); } Issue 4: Identical to issue 1 but for SMTP. $use_smtp_tls = 2 and STARTTLS in class/deliver/Deliver_SMTP.class.php, class class Deliver_SMTP, function initStream, does not honor stream options. BR Tobias ----- squirrelmail-devel mailing list Posting guidelines:http://squirrelmail.org/postingguidelines List address:squirrelmail-devel@lists.sourceforge.net List archives:http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options):https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

1 0

Still muddling through with broken auth...
by Jason Pruim 03 Apr '16

03 Apr '16

Hey Everyone, I’m still muddling through my first install… Followed the tutorials on workaround.org <http://workaround.org/> which were very helpful! but don’t include much info if things don’t work 100%… and so far I haven’t been able to pin down where the error is. When I try: telnet localhost 143 this is what shows up in the maillot: Apr 2 21:06:57 ip-172-31-24-2 dovecot: auth: Fatal: Unknown database driver 'sql' Apr 2 21:06:57 ip-172-31-24-2 dovecot: master: Error: service(auth): command startup failed, throttling for 2 secs Apr 2 21:06:57 ip-172-31-24-2 dovecot: imap-login: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<+lw34IYvVgB/AAAB> With the failed driver for the database, I tried mysql and sql both of which produce the same error… I have a few other issues but I think those are related farther upstream… Not being able to sign into round cube for webmail, because of it being unable to connect to the storage container… But I think that’s a round cube issue… I want to get postfix and dovecot playing nicely before I worry too much about things like webmail access… Here is my postconf -n: [ec2-user@ip-172-31-24-2 dovecot]$ postconf -n alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases command_directory = /usr/sbin config_directory = /etc/postfix daemon_directory = /usr/libexec/postfix data_directory = /var/lib/postfix debug_peer_level = 2 html_directory = no inet_interfaces = localhost inet_protocols = all mail_owner = postfix mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man mydestination = $myhostname, localhost.$mydomain, localhost newaliases_path = /usr/bin/newaliases.postfix queue_directory = /var/spool/postfix readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES sample_directory = /usr/share/doc/postfix-2.6.6/samples sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop unknown_local_recipient_reject_code = 550 virtual_mailbox_domains = hash:/etc/postfix/virtual_mailbox_domains virtual_mailbox_maps = hash:/etc/postfix/virtual_mailbox_users virtual_transport = dovecot [ec2-user@ip-172-31-24-2 dovecot]$ What else can I provide? Thanks! Jason Pruim pruimj(a)gmail.com 352.234.3175

3 11

Dovecot with LDAP/AD has problem with uid/gid
by Luca Bertoncello 02 Apr '16

02 Apr '16

Hi list! I have a Server connected to an AD and I need to configure Dovecot to authenticate the users against the AD (with password and GSSAPI). Now I'm trying to connect Dovecot to the AD with password. The authentication works, but I always got this error: Apr 2 13:03:49 mail dovecot: pop3-login: Login: user=<lucabert>, method=PLAIN, rip=192.168.50.1, lip=192.168.50.3, mpid=3508, session=<ZWJDc34vDgDAqDIB> Apr 2 13:03:49 mail dovecot: pop3(lucabert): Error: stat(/var/spool/mail/lucabert/tmp) failed: Permission denied (euid=10001(lucabert) egid=10000(domain users) missing +x perm: /var/spool/mail/lucabert, dir owned by 1005:8 mode=0700) Apr 2 13:03:49 mail dovecot: pop3(lucabert): Error: Couldn't open INBOX: Internal error occurred. Refer to server log for more information. [2016-04-02 13:03:49] My configuration: # 2.2.9: /etc/dovecot/dovecot.conf # OS: Linux 3.13.0-83-generic x86_64 Ubuntu 14.04.4 LTS nfs auth_gssapi_hostname = mail.cch.intra auth_mechanisms = plain login cram-md5 gssapi auth_use_winbind = yes auth_username_chars = disable_plaintext_auth = no login_greeting = mail.cch.intra ready. mail_fsync = always mail_gid = 8 mail_location = maildir:/var/spool/mail/%Ln mail_nfs_index = yes mail_uid = 1005 mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocols = " imap pop3" ssl_cert = </etc/dovecot/dovecot.pem ssl_key = </etc/dovecot/private/dovecot.pem userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap override_fields = uid=1005 gid=8 euid=1005 } userdb { args = uid=1005 gid=8 home=/var/spool/mail/%n allow_all_users=yes driver = passwd-file override_fields = uid=1005 gid=8 euid=1005 } auth-ldap.conf.ext: passdb { driver = ldap # Path for LDAP configuration file, see example-config/dovecot-ldap.conf.ext args = /etc/dovecot/dovecot-ldap.conf.ext } userdb { driver = ldap args = /etc/dovecot/dovecot-ldap.conf.ext # Default fields can be used to specify defaults that LDAP may override #default_fields = home=/home/virtual/%u override_fields = uid=1005 gid=8 euid=1005 } and in my /etc/dovecot/dovecot-ldap.conf.ext I have: user_attrs = \ =uid=1005, \ =gid=8, \ =quota_rule=*:bytes=%{ldap:quotaBytes}, \ =home=/var/spool/mail/%{ldap:sAMAccountName}, \ =mail=maildir:/var/spool/mail/%{ldap:sAMAccountName}/Maildir But it seems that all these settings for uid/gid will be ignored/overwritten... Of course the Mailboxes have user 1005 and group 8. Can someone help me? Thanks Luca Bertoncello (lucabert(a)lucabert.de)

1 1

Save UID & metadata of mail in mysql table
by use experience 02 Apr '16

02 Apr '16

Team, I would like to save UID and metadata of mail in mysql table. I am trying to achieve this using dovecot plugin mail-filter. Also would like to do in the process of mail store (using Dovecot LDA). How can I get UID & metadata through script.

2 3

SIS deduplication fails to create intermediate directories and funny permissions
by Jesus Cea 01 Apr '16

01 Apr '16

I have configured my system to use SIS, sharing the same same storage for all users, and offline deduplication. I have this in my "root" cron: """ 53 1 * * * /usr/local/bin/doveadm purge -A 16 * * * * /usr/local/bin/doveadm sis deduplicate /home/dovecot/buzones/attachments /home/dovecot/buzones/attachments/queue """ Yes, it is launched as "root" but I would expect doveadm drop privileges as soon as possible. This is working great, but from time to time I get this error message: """ Your "cron" job on babylon5 /usr/local/bin/doveadm sis deduplicate /home/dovecot/buzones/attachments /home/dovecot/buzones/attachments/queue produced the following output: Error: mkdir(/home/dovecot/buzones/attachments/dc/62/hashes) failed: No such file or directory """ Looks like doveadm is trying to create the "hashes" directory but the parent "62" doesn't exits yet. If I create that directory by hand and set permissions correctly, everything (seems to) work. Talking about this, I see something strange wit the permissions. All files and directories in SIS are created with "dovemail" user and group EXCEPT the "hashes" directory inside the newly created directory. That is: When I get the error message, I have this: """ drwx------ 7 dovemail dovemail 7 Apr 1 13:28 . drwx------ 237 dovemail dovemail 237 Mar 24 20:09 .. drwx------ 3 dovemail dovemail 3 Feb 29 02:30 1d drwx------ 3 dovemail dovemail 3 Mar 9 01:53 7f drwx------ 3 dovemail dovemail 3 Feb 29 02:30 88 drwx------ 3 dovemail dovemail 3 Feb 29 02:30 8d """ I create the missing directory by hand and change permissions. Now I have: """ drwx------ 7 dovemail dovemail 7 Apr 1 13:28 . drwx------ 237 dovemail dovemail 237 Mar 24 20:09 .. drwx------ 3 dovemail dovemail 3 Feb 29 02:30 1d drwx------ 3 dovemail dovemail 3 Apr 1 13:30 62 drwx------ 3 dovemail dovemail 3 Mar 9 01:53 7f drwx------ 3 dovemail dovemail 3 Feb 29 02:30 88 drwx------ 3 dovemail dovemail 3 Feb 29 02:30 8d """ I run the deduplicator again (as root) and it creates a "hashes" directory inside the "62" directory... with user/group root/root. """ drwx------ 2 root root 2 Apr 1 13:30 hashes """ -- Jesús Cea Avión _/_/ _/_/_/ _/_/_/ jcea(a)jcea.es - http://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/ Twitter: @jcea _/_/ _/_/ _/_/_/_/_/ jabber / xmpp:jcea@jabber.org _/_/ _/_/ _/_/ _/_/ _/_/ "Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ "My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/ "El amor es poner tu felicidad en la felicidad de otro" - Leibniz

1 0

default namespace
by Nerijus Baliunas 01 Apr '16

01 Apr '16

Hello, With no namespace settings and dovecot 2.0.9 I get the following listing: a LIST "" "*" * LIST (\HasNoChildren) "." "Trash" * LIST (\HasNoChildren) "." "Sent" * LIST (\HasNoChildren) "." "INBOX" a OK List completed. Then I add the namespaces: namespace inbox { separator = . prefix = inbox = yes hidden = no list = yes subscriptions = yes } namespace compat { separator = . prefix = INBOX. inbox = no hidden = yes list = no alias_for = } Then list output changes: a LIST "" "*" * LIST (\HasNoChildren) "." "Trash" * LIST (\HasNoChildren) "." "Sent" * LIST (\HasChildren) "." "INBOX" a OK List completed. INBOX now has \HasChildren, while before it had \HasNoChildren. How can I make it \HasNoChildren? Regards, Nerijus

1 1

mail filter plugin script doesn't effective
by use experience 31 Mar '16

31 Mar '16

output of *dovecot --version*: Dovecot version : 2.2.9 ----- output of *doveconf -n:* auth_debug = yes > > auth_mechanisms = plain login > > auth_verbose = yes > > disable_plaintext_auth = no > > mail_debug = yes > > mail_location = > maildir:/var/mail/vhosts/%d/%n:LAYOUT=fs:DIRNAME=dovecot_maildir > > mail_plugins = " mail_log notify mail_filter" > > mail_privileged_group = mail > > namespace inbox { > > inbox = yes > > location = > > mailbox Drafts { > > auto = subscribe > > special_use = \Drafts > > } > > mailbox Junk { > > special_use = \Junk > > } > > mailbox Sent { > > auto = subscribe > > special_use = \Sent > > } > > mailbox "Sent Messages" { > > auto = no > > special_use = \Sent > > } > > mailbox Spam { > > auto = create > > special_use = \Junk > > } > > mailbox Trash { > > auto = no > > special_use = \Trash > > } > > mailbox virtual/All { > > auto = no > > special_use = \All > > } > > prefix = > > } > > passdb { > > args = /etc/dovecot/dovecot-sql.conf.ext > > driver = sql > > } > > plugin { > > autocreate = Trash > > autocreate2 = Spam > > mail_filter = santhosh-filter %u > > mail_log_events = delete undelete expunge copy mailbox_delete > mailbox_rename flag_change save mailbox_create > > mail_log_fields = uid box msgid size flags vsize from subject > > } > > protocols = " imap lmtp pop3" > > service auth-worker { > > user = vmail > > } > > service auth { > > unix_listener /var/spool/postfix/private/auth { > > group = postfix > > mode = 0777 > > user = postfix > > } > > unix_listener auth-userdb { > > mode = 0777 > > } > > user = dovecot > > } > > service imap-login { > > executable = imap-login -R rawlogs > > } > > service imap-postlogin { > > executable = script-login /usr/local/bin/postlogin.sh > /etc/dovecot/script/echo.sh > > user = vmail > > } > > service imap { > > executable = imap imap-postlogin > > } > > service lmtp { > > unix_listener /var/spool/postfix/private/dovecot-lmtp { > > group = postfix > > mode = 0600 > > user = postfix > > } > > } > > service santhosh-filter-out { > > executable = script /usr/local/bin/mail-filter-out.sh > > unix_listener santhosh-filter-out { > > mode = 0777 > > user = vmail > > } > > user = dovecot > > } > > service santhosh-filter { > > executable = script /usr/local/bin/mail-filter.sh > > unix_listener santhosh-filter { > > mode = 0777 > > user = vmail > > } > > } > > ssl_cert = </etc/dovecot/dovecot.pem > > ssl_key = </etc/dovecot/private/dovecot.pem > > userdb { > > args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n > > driver = static > > } > > protocol imap { > > mail_plugins = " autocreate" > > } > >

2 4

VS: Re: v2.2.23 released
by Aki Tuomi 31 Mar '16

31 Mar '16

It's fixed in head. Sorry. ---Aki TuomiDovecot oy -------- Alkuperäinen viesti --------Lähettäjä: Eric <ebroch(a)whitehorsetc.com> Päivämäärä: 31.3.2016 18.05 (GMT+02:00) Saaja: dovecot(a)dovecot.org Aihe: Re: v2.2.23 released Yes. I concur. On 3/31/2016 7:44 AM, Leon Kyneur wrote: > 2.2.23 seems to have broken doveadm backup, was previously working > fine on 2.2.22 > > [root@S613 lkyneur]# doveadm -v backup -u em.mck ... > doveadm(root): Error: User doesn't exist > > > [root@S613 lkyneur]# doveadm user em.mck > field value > uid vmail > gid vmail > home /srv/vmail/eftel/xxx.com/20032218/em.mck > mail > mdbox:/srv/vmail/eftel/xxx.com/20032218/em.mck/mdbox:ALT=/altstorage/srv/vm… > quota_rule *:bytes=500M > > > On 30/03/16 23:48, Timo Sirainen wrote: >> http://dovecot.org/releases/2.2/dovecot-2.2.23.tar.gz >> http://dovecot.org/releases/2.2/dovecot-2.2.23.tar.gz.sig >> >> This is a bugfix-only release with various important fixes on top of >> v2.2.22. >> >> - Various fixes to doveadm. Especially running commands via >> doveadm-server was broken. >> - director: Fixed user weakness getting stuck in some situations >> - director: Fixed a situation where directors keep re-sending >> different states to each others and never becoming synced. >> - director: Fixed assert-crash related to a slow "user killed" reply >> - Fixed assert-crash related to istream-concat, which could have >> been triggered at least by a Sieve script.

3 2

Reply to : http://dovecot.org/pipermail/dovecot/2016-March/103789.html
by use experience 31 Mar '16

31 Mar '16

I dint get reply as mail to my mailed, so pasting here the link http://dovecot.org/pipermail/dovecot/2016-March/103791.html

1 0

Dovecot mail-filter execution error.
by use experience 31 Mar '16

31 Mar '16

Hello, While using mail-filter plugin, I am getting following error. Please help me. Mar 31 07:48:31 ip-172-31-29-173 dovecot: lda: Error: userdb lookup: connect(/var/run/dovecot/auth-userdb) failed: Connection refused Mar 31 07:48:31 ip-172-31-29-173 dovecot: lda: Fatal: Internal error occurred. Refer to server log for more information.

2 2